Happy birthday to Let’s Encrypt !

Huge thanks to everyone involved in making HTTPS available to everyone for free !

  • 0x01@lemmy.ml
    link
    fedilink
    English
    arrow-up
    152
    ·
    1 month ago

    Man I love let’s encrypt, remember how terrible ssl was before the project landed?

    • Rikudou_Sage@lemmings.world
      link
      fedilink
      English
      arrow-up
      65
      ·
      1 month ago

      Crazy times. Nowadays it’s weird when a website doesn’t have https. Back then it was pretty much big companies only. And the price of a wildcard certificate…

    • pcouy@lemmy.pierre-couy.frOP
      link
      fedilink
      English
      arrow-up
      31
      ·
      1 month ago

      I did not have the money to pay the insane amounts these greedy for-profit certificate authorities asked, so I only remember the pain of trying to setup my self-signed root certificate on my several devices/browsers, and then being unable to recover my private key because I went over the top with securing it.

    • leisesprecher@feddit.org
      link
      fedilink
      English
      arrow-up
      23
      ·
      1 month ago

      And if you remember, that this whole shebang was only started, because Snowden revealed that the NSA spied on all of us, it’s getting much much darker.

      • rottingleaf@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 month ago

        People behave as if having a green lock icon were enough to consider you’re safe.

        People behave as if there were not multiple cases of abuse of PKI.

        People behave as if all those whistleblowing cases exposing widespread illegal activities by the state were not treated as normal, except those exposing them being chased and vilified.

        What I’m trying to say is that we’re past the stage where techno-optimism about the Internet made sense. They just say in the news that abusing you is good, and everybody just takes it.

      • xthexder@l.sw0.com
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 month ago

        Oh man, I forgot about startssl until just now. I definitely had a few of those certs. If you wanted something fancy like a wildcard cert back then, you were paying $$$

        • lud@lemm.ee
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          1
          ·
          1 month ago

          Luckily, wildcard certs are insecure and should be avoided.

          • xthexder@l.sw0.com
            link
            fedilink
            English
            arrow-up
            3
            ·
            1 month ago

            Wildcard certs are perfectly fine. Your own instance lemm.ee is using one right now.

            Obviously there could be issues if subdomains are shared with other sites, but if the whole domain is owned by 1 person, what does it matter?

            • lud@lemm.ee
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 month ago

              If one system is somehow compromised, the attacker could effectively impersonate all the systems on your entire domain if they had the wildcard cert. Maybe it’s not a huge deal for individuals but for companies or other organisations it could be extremely dangerous.

              If someone wanted a wildcard cert at work I would be very cautious before I even considered issuing one. Unfortunately there are a few wildcard certs on our domain, but those are from before my time.

              • pcouy@lemmy.pierre-couy.frOP
                link
                fedilink
                English
                arrow-up
                2
                ·
                1 month ago

                Having a certificate for any subdomain has implications for other sibling domains, even without a wildcard certificate.

                By default, web browsers are a lot less strict about Same Origin Policy for sibling domains, which enables a lot of web-based attacks (like CSRF and cookie stealing) if your able to hijack any subdomain

    • dan@upvote.au
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 month ago

      I remember the days when each site that wanted to use SSL had to have a dedicated IP.

    • rottingleaf@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 month ago

      When you have to use it, then yes. But in general standard technologies of today are mostly rigged.

  • somenonewho@feddit.org
    link
    fedilink
    English
    arrow-up
    40
    ·
    1 month ago

    Damn! That’s definitely a “I’m old” moment for me. I still remember when I first heard about the concept and I remember setting it up the first time on a self hosted project (which seemed harder back then).

    Awesome project!

  • kaotic@lemmy.world
    link
    fedilink
    English
    arrow-up
    31
    ·
    1 month ago

    A client of mine pays for an SSL cert he doesn’t even use. I’ve told him before I moved him to Let’s Encrypt because I was able to automate the renew process. He decided he needed to continue paying for the SSL cert. I told him we are not using it, but he doesn’t believe me. So he continues to pay for it.

    • pagenotfound@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      1 month ago

      I love it when companies are too stubborn to update their costs despite the necessity changing over the years.

      My previous employment kept buying microsoft office license keys despite us already moving to 365. They probably did it out of habit when buying new computers. Needless to say I have a cardstack of license keys at home lol. Granted it’s for Office 2013 but I don’t really need the latest version for basic document processing.

    • dan@upvote.au
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 month ago

      TLS certificates have huge margins, so web hosts love selling them.

  • __matthew__@lemmy.world
    link
    fedilink
    English
    arrow-up
    30
    ·
    1 month ago

    Lol I instinctively freaked out when I saw the post preview assuming it was going to be a post about a major data breach or exploit of some sort relating to Let’s Encrypt.

    I probably need more positivity in my life 😂

  • fiendishplan@lemmy.world
    link
    fedilink
    English
    arrow-up
    23
    ·
    1 month ago

    I worked for a company we had 300 websites, the boss wanted to buy certs. I told him about Lets Encrypt. He loved the idea it saved us a bunch of money. I suggest we donate $100 to them. Hes says “NO F-ing way!”.

    • FMEEE@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      1
      ·
      1 month ago

      Today it’s just more or less stupid to buy SSL you can get one extremely easy for free from Let’s Encrypt or Google Trust…

    • bfg9k@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 month ago

      My last cert renewal was $20 for 3 years. That’s less than a dollar a month, not exactly breaking the bank.

      • nek0d3r@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 month ago

        It’s been a bit since I’ve asked them, but they certainly complained about the cost before. Almost as much as the hosting itself for sure.

  • RoyaltyInTraining@lemmy.world
    link
    fedilink
    English
    arrow-up
    16
    ·
    1 month ago

    Let’s Encrypt is amazing, but are there any equally trustworthy alternatives people could switch to if something bad happens to it?

    • treadful@lemmy.zip
      link
      fedilink
      English
      arrow-up
      12
      ·
      1 month ago

      They came up with the ACME protocol, so presumably somebody could. The real barrier to entry is the cost of getting into that certificate chain of trust. I have no idea why it’s so difficult and expensive.

      • xthexder@l.sw0.com
        link
        fedilink
        English
        arrow-up
        12
        ·
        1 month ago

        Well, it’s difficult, as it should be, because if you control a certificate in the active chain of trust of browsers, you can hack pretty much anything you want.

        • treadful@lemmy.zip
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          edit-2
          1 month ago

          Correct me if I’m wrong, but isn’t the CA only signing your public key to prove identity/authority? I don’t think the CA can magically MITM every cert they sign.

          The impact is not serious enough to warrant a $1m entry fee, IMO. At best, someone could impersonate a site. They’d also have to get other things in line (e.g. DNS hijacking) to be at all successful anyway. And it’s not like most people are authenticating certs themselves. They just trust browsers to trust CAs that vouch for you and prevents those scary browser warnings.

          It doesn’t improve encryption compared to a self-signed cert though.

          • xthexder@l.sw0.com
            link
            fedilink
            English
            arrow-up
            9
            arrow-down
            1
            ·
            edit-2
            1 month ago

            If you are the CA, you can sign a new certificate yourself for google.com and the browser will accept it. It’s effectively allows MITM for any certificate. Worse, it’s not even limited to certificates under that CA. The browser has no way of knowing there’s 2 “valid” certs at once, and in fact that is allowed regardless (multiple servers with different instances of the SSL cert is a possibility).

            Certificate pinning might save things, since that will force the same certificate as was previously used, but I’m not sure this is a common default.

    • fmstrat@lemmy.nowsci.com
      link
      fedilink
      English
      arrow-up
      8
      ·
      1 month ago

      If it begins to enshitify, someone will quickly take up the helm. It’s become so core now that someone like Cloudflare would just be like “We do this now.”

          • Redjard@lemmy.dbzer0.com
            link
            fedilink
            English
            arrow-up
            1
            ·
            edit-2
            1 month ago

            Yes, seems you are right. Not sure where I got the impression.

            Unrelated, when I researched this I saw that acme.sh, zerossl, and a bunch of other acme clients are owned by the same entity, “Stack Holdings”/“apilayer.com”. According to this, zerossl also has some limitations over letsencrypt in account requirements and limits on free certificates.

            By using ZeroSSL’s ACME feature, you will be able to generate an unlimited amount of 90-day SSL certificates at no charge, also supporting multi-domain certificates and wildcards. Each certificate you create will be stored in your ZeroSSL account.

            It is suspicious that they impose so many restrictions then waive most on the acme api, where they presumably could not compete otherwise. On their gui they allow only 3 certificates and don’t allow multi-domain at all. Then even in the acme client they somehow push an account into the process.

            […] for using our ACME service you have to create and use EAB (External Account Binding) credentials within your ZeroSSL dashboard.

            EAB credentials are limited to a maximum per user/per day. [This might be for creating them, not uses per credential, unsure how to interpret this.]

            This all does make me slightly worry this block around apilayer.com will fall before letsencrypt does.

            Other than letsencrypt and zerossl, this page also lists no other full equivalents for what letsencrypt does.

            • Laser@feddit.org
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 month ago

              I think if LetsEncrypt went away, so would ZeroSSL’s free offer.

              However, I do think not having limitations on the API is good; automation is good practice and I guess this is a concession to customers /users who have no automation in place (though this is a sad state by now). LE doesn’t offer anything comparable AFAIK.

    • dan@upvote.au
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      1 month ago

      ZeroSSL, plus a few paid companies support ACME (I know Sectigo and GoDaddy do). Sure, the latter are paid services, but in theory you can switch to them and use the exact same setup you’re currently using with Let’s Encrypt, just with some config changes.

  • laxe@lemmy.world
    link
    fedilink
    English
    arrow-up
    15
    ·
    1 month ago

    Huge impact on a tiny budget - that’s extremely impressive. The world could be so much better without rent seeking parasites.

  • jj4211@lemmy.world
    link
    fedilink
    English
    arrow-up
    10
    ·
    1 month ago

    Just two months ago, a security team member dinged one of our services for using Lets Encrypt, as “it’s not as secure as a traditional CA”.

    • bfg9k@lemmy.world
      link
      fedilink
      English
      arrow-up
      15
      ·
      1 month ago

      I’d love for them to explain how, if anything the short cert validity and constant re-checking of the domain seems more secure than traditional CAs

      • dan@upvote.au
        link
        fedilink
        English
        arrow-up
        7
        ·
        edit-2
        1 month ago

        I’d also argue that the fact that it’s 100% automated and their software is open source makes it objectively more secure. On the issuing side, there’s no room for human error, social engineering, etc.

    • EnderMB@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 month ago

      It’s sad that these arguments are still being shared. It was the same arguments years ago from people that would just assume that a free cert was inherently unsafe.

    • NιƙƙιDιɱҽʂ@lemmy.world
      link
      fedilink
      English
      arrow-up
      39
      ·
      edit-2
      1 month ago

      HTTPS certs used to be very expensive and technically complicated, making it out of reach for most smaller orgs. Let’s Encrypt brought easy mass adoption and changed encryption availability on the web for everyone.

      • dan@upvote.au
        link
        fedilink
        English
        arrow-up
        7
        ·
        edit-2
        1 month ago

        They also made it a open protocol (the ACME protocol), so now there’s a bunch of certificate providers that implement the same protocol and thus can work with the same client apps (Certbot, acme.sh, etc). I know Sectigo and GoDaddy support ACME at least. So even if you don’t use Let’s Encrypt, you can still benefit from their work.

    • EngineerGaming@feddit.nl
      link
      fedilink
      English
      arrow-up
      17
      ·
      1 month ago

      It is the free, easy way to get an SSL cert (plus automated renewals). Without it, maybe HTTPS wouldn’t have been so omnipresent.

      • rottingleaf@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        3
        ·
        1 month ago

        And it shouldn’t have been, SSL PKI is an intentionally rigged architecture. It’s intended for nation-states to be able to abuse it.

        I’d like much more some kind of overlay encryption over HTTP based on web of trust and what not. Like those distributed imageboards people were trying to make with steganography in emotion.

        It’s a trap. Everybody is already in it and it has already been activated, so - the discussion would be of historical interest only.

  • jagged_circle@feddit.nl
    link
    fedilink
    English
    arrow-up
    7
    ·
    edit-2
    1 month ago

    Lots of people shitting on stories of people who buy certs.

    You do still have to buy a cert if you want one for a .onion. Let’s encrypt still doesn’t support it :(